afv-library/skills/running-code-analyzer/references/vendor-file-handling.md

Vendor File Handling

Problem

Code Analyzer scans all JavaScript files, including third-party vendor libraries like jQuery, Bootstrap, Lodash, Handlebars, etc. These libraries often trigger thousands of violations, especially:

• no-var (legacy var declarations)
• prefer-const (variables that could be const)
• code style (indentation, quotes, semicolons)

A typical scan might find:

• 9,714 total violations
• 9,089 in vendor files (jQuery UI, Bootstrap, tablesorter)
• 634 in project source (your Aura/LWC components)

Why You Shouldn't Fix Vendor Files

Risk	Impact
Breaks upgrades	Modified vendor files can't be cleanly upgraded to newer versions
Untested changes	Libraries weren't designed for strict mode or modern JS patterns
Subtle bugs	Converting var to let/const can change scope/hoisting behavior in legacy code
Maintainability	Future developers won't know the file was modified and why
Wasted effort	The next library upgrade will overwrite your fixes anyway

Solutions

Solution 1: Re-scan with --target (Fastest)

If you know your project source locations upfront:

sf code-analyzer run --rule-selector <selector> \
  --target "force-app/main/default/aura,force-app/main/default/lwc" \
  --output-file "./results-project-only.json" \
  --include-fixes

Pros:

• Only scans what you need
• Faster execution
• Cleaner results

Cons:

• Must know target directories upfront
• Doesn't show you what violations exist in vendor files (for awareness)

Solution 2: Intelligent Filtering (Most Accurate)

Scan everything first, then use the intelligent filter script to separate vendor from project:

# 1. Run full scan
sf code-analyzer run --rule-selector <selector> \
  --output-file "./results-all.json" --include-fixes

# 2. Filter to project files only
node "<skill_dir>/scripts/filter-violations.js" \
  "./results-all.json" \
  "./results-project.json" \
  --report

# 3. Apply fixes to filtered results
node "<skill_dir>/scripts/apply-fixes.js" "./results-project.json"

Pros:

• Intelligent classification using multiple heuristics
• Shows you vendor vs project breakdown
• Handles uncertain files (30-70% confidence)
• No manual pattern maintenance

Cons:

• Scans more files than necessary
• Takes longer for large codebases

How the Intelligent Filter Works

The filter-violations.js script uses a multi-heuristic confidence scoring system:

1. Path-Based Signals (30% weight)

// High confidence vendor indicators
node_modules/          → 100% vendor
bower_components/      → 100% vendor
vendor/                → 95% vendor
third-party/           → 95% vendor
StaticResourceSources/ → 70% vendor

// Project source indicators
force-app/main/default/aura/    → Project
force-app/main/default/lwc/     → Project

2. Name-Based Signals (30% weight)

// Filename patterns
*.min.js               → 95% vendor (minified)
*-1.12.1.js           → 85% vendor (version in name)
jquery*.js            → 85% vendor (known library)
bootstrap*.js         → 85% vendor (known library)

// Checked against package.json dependencies

3. Content-Based Signals (40% weight)

// License headers
MIT License, Apache, BSD, GPL → 80% vendor

// Minification indicators
Average line length > 500 chars → 90% vendor
< 10 lines but > 5KB file     → 85% vendor

// Library patterns
UMD/AMD/CommonJS wrapper       → 70% vendor
@version x.x.x                 → 65% vendor
@author (non-project)          → 50% vendor

Final Score

Weighted Score = (PathScore × 0.3) + (NameScore × 0.3) + (ContentScore × 0.4)

> 70% = Vendor file
< 30% = Project file
30-70% = Uncertain (manual review)

Example Output

=== INTELLIGENT VENDOR FILE DETECTION ===

Original violations: 9714
Filtered violations: 634
Reduction: 9080 (93.5%)

📦 Vendor files excluded: 127
   610 violations | 95% confidence | jquery-ui-1.12.1.js
        located in vendor directory, version number in filename, minified file
   525 violations | 98% confidence | jquery-ui-1.12.1.min.js
        located in vendor directory, minified file (.min.js)
   ... and 125 more vendor files

✅ Project files included: 39
   157 violations | CRLP_RollupHelper.js
   103 violations | HH_ContainerHelper.js
   84 violations | CRLP_FilterGroupHelper.js
   ...

⚠️  Uncertain files: 2
    These files have 30-70% vendor confidence - review manually:
   45 violations | 55% vendor | customUtility.js
        located in vendor directory

✓ Filtered results written to: ./results-project.json

Workflow Integration

When to Use Each Approach

Scenario	Recommended Approach
User says "fix no-var in my code"	Use intelligent filter (excludes vendor by default)
User says "fix all no-var"	Ask: "Including vendor files (jQuery, Bootstrap)?"
User specifies path	Use --target directly
User wants report first	Full scan → intelligent filter → show breakdown

Step-by-Step Workflow

1. Run Code Analyzer scan
2. Parse results
3. **Check violation distribution:**
   - If 50%+ are in vendor files → offer intelligent filtering
   - If user said "my code" or "project" → automatically filter
4. Discover fixes (on filtered or unfiltered results)
5. Apply fixes
6. Summarize

Edge Cases

Case 1: Vendored Modified Libraries

Scenario: Your org has modified a copy of jQuery

Solution: The intelligent filter will classify it as vendor, but violations may be legitimate. Options:

1. Fix manually after filter identifies it
2. Re-run with --target excluding that specific file
3. Add to project exceptions in filter script

Case 2: Project Code in Static Resources

Scenario: Your custom JavaScript is in staticresources/ alongside vendor libs

Solution: The filter checks content + name, not just path. Custom code without vendor markers scores as "project" or "uncertain" for manual review.

Case 3: Uncertain Classifications

Scenario: File scores 30-70% vendor confidence

Action: Filter script reports these separately. Review manually:

• Check file purpose
• Look for original source/documentation
• Decide whether to fix or exclude

Configuration (Future Enhancement)

The filter script could accept custom patterns:

node filter-violations.js results.json filtered.json \
  --exclude-patterns "*.min.js,jquery*,bootstrap*" \
  --include-patterns "force-app/main/default/aura/**,force-app/main/default/lwc/**"

Currently uses intelligent defaults and doesn't require configuration.

Testing the Filter

# Run with detailed report
node scripts/filter-violations.js \
  ./code-analyzer-results-20260519-133252.json \
  ./filtered-output.json \
  --report

# Check the output
node scripts/parse-results.js ./filtered-output.json

Compare before/after violation counts to verify filtering accuracy.